feat(P4): regression-gate policies + docs (REQ-304..307)

regression/ policies (3): cap-013-adapter-dedup, cap-023-metrics-collector,
cap-024-deck-structure — declarative mirrors of core/regression_verify.py
over capability-inventory JSON. The imperative regression_verify.py is kept
(drives CI gate); the policies are the declarative mirror (IDEATE I1 quality
improvement).

tests: test_regression_policies.py + clean/drifted fixtures. Skip-without-kj.

docs: adapters/README.md (new kyverno-json row + PolicyEngine Protocol
section with how-to-add-OpaEngine), adapters/kyverno-json/README.md (engine,
install, policy directory layout, 4 categories, severity convention),
schemas/README.md (D-116 engine enum reuse note), modules/STANDARDS.md §10
Policy Authoring Standard, docs/METRICS.md (swappable engine narrative).

---ci---
project: acdl
phase: 4
milestone: v1.25
status: execute
phase_role: execution
requirements:
  covered: [REQ-304, REQ-305, REQ-306, REQ-307]
  partial: []
---/ci---

docs/METRICS.md

@@ -174,4 +174,18 @@ numbers. Every metric either has a real source or is explicitly deferred.
 | SLA / Unplanned Downtime | D-096 | `placeholder_sla_downtime.csv` |
 | Predictive vs Reactive Ratio | future emitter | `placeholder_predictive_reactive.csv` |
 
-See `docs/METRICS_DEFERRED_ROADMAP.md` for the activation path for each.
+See `docs/METRICS_DEFERRED_ROADMAP.md` for the activation path for each.
+
+---
+
+## v1.25 — Swappable Policy Engine
+
+The policy engine that produces the `PolicyCheckResult` records feeding
+the confidence signal is **swappable** (NORTH_STAR Strategic Objective #2
+— provable trust via a replaceable substrate, not a vendor lock-in).
+The `PolicyEngine` protocol (`core/policy_engine.py`) is the swap
+boundary; `config.json.policy.engine` selects the active engine
+(default `"kyverno-json"`). A future `OpaEngine` implements the same
+protocol without touching the confidence signal, the PCR schema, or
+the pipeline. See `.ciagent/ARCHITECTURE.md` §12.7 for the registry
+diagram.